Re: initial_sid context via libsepol

[Stephen Smalley <sds@tycho.nsa.gov>]

On 03/07/2016 08:32 PM, William Roberts wrote:
>
>
> On Mon, Mar 7, 2016 at 12:32 PM, Stephen Smalley <sds@tycho.nsa.gov
> <mailto:sds@tycho.nsa.gov>> wrote:
>
>     On 03/07/2016 01:44 PM, Stephen Smalley wrote:
>
>         On 03/07/2016 10:41 AM, Richard Haines wrote:
>
>
>
>
>
>
>                 On Saturday, 5 March 2016, 14:48, Richard Haines
>                 <richard_c_haines@btinternet.com
>                 <mailto:richard_c_haines@btinternet.com>> wrote:
>
>
>
>
>
>                 On Friday, 4 March 2016, 21:18, "Roberts, William C"
>                 <william.c.roberts@intel.com
>                 <mailto:william.c.roberts@intel.com>> wrote:
>
>
>
>
>
>
>                     How can one obtain the same value as
>                     /sys/fs/selinux/initial_contexts/file
>
>                 via libsepol?
>
>
>                     I’ve been digging around libsepol and its not quite
>                     clear to me.
>
>                     It looks as though the record is here:
>                                       context_struct_t *a = &((policydb_t
>
>                 *)pol.db)->ocontexts[OCON_ISID]->context[0];
>
>                                       context_struct_t *b = &((policydb_t
>
>                 *)pol.db)->ocontexts[OCON_ISID]->context[1];
>
>
>                                       printf("%u\n", a->type);
>                                       printf("%u\n",b->type);
>
>                     Prints:
>                     185
>                     0
>
>                     Not sure if this is right, and how to format the
>                     context struct to a
>                     string.
>
>                 I didn’t see any helpers.
>
>
>
>
>
>                 I've attached an example, hope it's useful
>
>
>             I've updated the example with more detail and display SID
>             name using
>             SID value not counter.
>
>
>         Any particular reason you didn't use sepol_sid_to_context()?
>
>
>     I guess context_to_string() on the context structure would work
>     better for your purposes.   sepol_sid_to_context() would require
>     loading the sidtab via policydb_load_isids() and setting the
>     internal policydb to the one you loaded via sepol_set_policydb().
>
>
>
> Seems as though its not exported api, but it does indeed print something:
> code:
> char *s;
> size_t len;
> context_struct_t *a = &((policydb_t
> *)pol.db)->ocontexts[OCON_ISID]->context[0];
>
> int rc = context_to_string(pol.handle, (policydb_t *)pol.db, a, &s, &len);
>
> printf("rc: %d\n", rc);
> printf("con: %s\n", s);
>
> prints:
>    rc: 0
>    con: u:object_r:null_device:s0
>
> However, I am after the initial sid for file, which this isn't it... is
> it in the ocontexts array under a different index?

ocontext[OCON_ISID] points to the head of a linked list of initial SIDs, 
with the values in ->sid[0] and the context structures in ->context[0]. 
  Richard's sample program showed you how to walk it and print out all 
the entries.  The symbolic names themselves aren't in the policydb, as 
he noted; you can grab it from the kernel source 
(linux/security/selinux/include/initial_sid_to_string.h) or from the 
refpolicy (run make in refpolicy/policy/flask and grab 
kernel/initial_sid_to_string.h).